CSX Security Operations Center (SOC) Operations 2

Question 1

What does SIEM stand for in cybersecurity?

Accepted Answer

Security Information and Event Management

Answer

System Integration and Event Monitoring

Answer

Secure Infrastructure and Endpoint Management

Answer

Security Incident and Emergency Management

Question 2

What is log normalization in the context of SIEM operations?

Accepted Answer

Converting logs from various sources into a standardized, consistent format for analysis

Answer

Deleting old log files to reclaim storage space

Answer

Encrypting log files before storing them to ensure confidentiality

Answer

Compressing logs for faster network transmission between agents

Question 3

What is a correlation rule in a SIEM system?

Accepted Answer

A logical condition that combines multiple events to identify potential security incidents

Answer

A backup procedure used for database disaster recovery

Answer

A compliance checklist generated for external auditors

Answer

A network routing protocol for directing log traffic to the SIEM

Question 4

What does IOC stand for in the context of threat intelligence and SIEM analysis?

Accepted Answer

Indicator of Compromise

Answer

Internal Operations Center

Answer

Internet Outbound Connection

Answer

Incident Operations Coordinator

Question 5

Which of the following is an example of behavioral-based detection in a SIEM?

Accepted Answer

Detecting an unusual spike in outbound data transfers from a single host at 2 AM

Answer

Matching a file hash against a known malware signature database

Answer

Blocking a known malicious IP address at the firewall

Answer

Scanning endpoints for missing operating system patches

Question 6

What is the primary purpose of log retention policies in a SOC?

Accepted Answer

To ensure logs remain available for incident investigation, forensic analysis, and compliance requirements

Answer

To reduce the cost of analyst salaries by limiting the data they review

Answer

To improve real-time network performance by purging old data

Answer

To automate security patch deployment across endpoints

Question 7

Which SIEM capability helps analysts reconstruct the sequence of events during a security incident?

Accepted Answer

Event correlation and timeline visualization across log sources

Answer

User interface color theming and dashboard personalization

Answer

Automated printer and peripheral device management

Answer

Software license tracking and renewal notifications